High CPU utilization in Linux VMs due to vmtoolsd authentication loops

Products

• VMware vSphere ESXi

Issue/Introduction

Multiple vCenters managing numerous hosts and thousands of VMs all experience a sudden and simultaneous increase in CPU utilization.  In particular, Linux-based VMs see a CPU usage spike originating with the vmtoolsd process.

Symptoms

• vCenter reports CPU load at or above 100% for multiple clusters.
• ESXi hosts show unexpected jumps in CPU utilization.
• vmtoolsd process within guest operating systems consumes excessive CPU resources.

Environment

vSphere 8.0 U3
Linux Guest Operating Systems
VMware Tools

Cause

An increase across multiple environments spanning vCenters is usually indicative of a wider environmental issue, such as an erroneous automated task. For example, if an automated task attempting to access VMs (list processes, start programs, etc.) using Pluggable Authentication Module (PAM) via vmtoolsd fails due to incorrect account credentials, this triggers repeated authentication retry loops causing the vmtoolsd process to consume available CPU resources.

To investigate the cause, SSH to the vCenter Appliance with root, then run the following command to display the journal logs:

journalctl -b | grep -E "Event|VGAuth|vmtoolsd"

Find the task(s) by searching for the user, virtual machine name or timestamp when the issue occurred:

Jul 17 18:17:01 vcenter.example.com vpxd[5896]: Event [253081] [1-1] [2026-07-17T18:17:01.313786Z] [vim.event.EventEx] [info] [EXAMPLE.COM\USERNAME] [ISE] [253081] [Guest operation List Processes performed on Virtual machine test-vm-01.]
Jul 17 18:17:02 vcenter.example.com vpxd[5896]: Event [253092] [1-1] [2026-07-17T18:17:02.897858Z] [vim.event.EventEx] [warning] [EXAMPLE.COM\USERNAME] [ISE] [253092] [Guest operation authentication failed for operation Start Program on Virtual machine test-vm-01.]
Jul 17 18:17:03 vcenter.example.com VGAuth[1383]: pam_unix(vmtoolsd:auth): check pass; user unknown
Jul 17 18:17:03 vcenter.example.com VGAuth[1383]: pam_unix(vmtoolsd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Jul 17 18:17:03 vcenter.example.com VGAuth[1383]: pam_unix_auth(vmtoolsd:auth): check pass; user unknown
Jul 17 18:17:04 vcenter.example.com VGAuth[1383]: vmtoolsd: Username and password mismatch for 'USERNAME'.

Resolution

1. Identify and stop the automated task.
2. Restart the vmtoolsd process on impacted VMs.
3. Verify account credentials and permissions and investigate any recent activities associated with the particular account and the failed task(s).
4. If the issue persists, contact Broadcom Support.

Additional Information

There are some instances where this increase in CPU may be attributed to a recent vSphere version upgrade, see:
ESXi host CPU usage appears high in vCenter default charts due to Turbo Boost and Hyperthreading counter behavior

How to configure vmtoolsd to use common authentication mechanism using PAM